Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    05/05/2024, 01:07

General

  • Target

    1ab6ed17a955c5da7b3341ed7c5af8c8bb956cd6a00382ecb3babc832934f308.exe

  • Size

    4.4MB

  • MD5

    c96e728ba7febe27e85b9acc04ddbf2c

  • SHA1

    de8c3ff03cdf8a32bdb16fdaaaeff4b68fab72a0

  • SHA256

    1ab6ed17a955c5da7b3341ed7c5af8c8bb956cd6a00382ecb3babc832934f308

  • SHA512

    f7606c02954b87b964cbd1aa208330fdc0af42e959d30fe64bf908647fb3efa241dd94b534ec4bd1f4a3fb07ba086702dfbbb96fc6b4d4e2032d56df27f25bc3

  • SSDEEP

    98304:AyJOZ0Fb32Sh4H8U5I49z0Uwk3kqXf0FF5v:AyEZMhmPI49d13kSIFF

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1ab6ed17a955c5da7b3341ed7c5af8c8bb956cd6a00382ecb3babc832934f308.exe
    "C:\Users\Admin\AppData\Local\Temp\1ab6ed17a955c5da7b3341ed7c5af8c8bb956cd6a00382ecb3babc832934f308.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    PID:1460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\Costura\03F70F6D8235AE0160301AA5D72B0F83\32\microsoft.web.webview2.core.dll

    Filesize

    538KB

    MD5

    f1dac51a74f4799838be29934a288c5c

    SHA1

    1e3ef5deb4e3f7a01656fbc3b7833276c3297a2f

    SHA256

    a7baa548c354ef9223f4fd19d2bae33c3eb8cb987bf7b577828897388110740f

    SHA512

    7d2a9f31d41a5f81cadf55961bf7fcc9eaa64393427e530303bc966088978cf28b22a186cb82ba251d82d210a4bd37c753f11e058209ea0e26dd2af91e1db5ab

  • \Users\Admin\AppData\Local\Temp\Costura\03F70F6D8235AE0160301AA5D72B0F83\32\microsoft.web.webview2.wpf.dll

    Filesize

    46KB

    MD5

    9022d0f3e7b23ac1525b01d339582bd8

    SHA1

    97919a2bf43a7f3ada9fecb1fc9e6d5cc673f46c

    SHA256

    ba0de999989a0cc45e5650503d4755bb9ff56e922741d1724747147811657c5d

    SHA512

    82c2e5f68a39906c1b5a29d22544a0545cb51793edcd6b4326f37dbc5dc61fb5d8f848937a6dea4b66594a4c38f3d6974ecda5be7fbd6dad947e936dab7d9dd5

  • \Users\Admin\AppData\Local\Temp\Costura\03F70F6D8235AE0160301AA5D72B0F83\32\webview2loader.dll

    Filesize

    113KB

    MD5

    80243b7f55a36f54b0c1c3735e883861

    SHA1

    06800e33619b24c60292aab984df47489ce4d64b

    SHA256

    7cddfcd327290d5f1b997ea9636a4595b5188c8a5ab495a4251bad46709a0c62

    SHA512

    06dd2a24e898d11dbf3b03df208ac9822e4ccadd6a38c424b17ed94cb00b1372ba5794fe4fa93ddf7175455c950301c0bcb3134748d5494f089d01fe8c68ba07

  • memory/1460-0-0x00000000745DE000-0x00000000745DF000-memory.dmp

    Filesize

    4KB

  • memory/1460-1-0x0000000000270000-0x00000000006DC000-memory.dmp

    Filesize

    4.4MB

  • memory/1460-13-0x00000000745D0000-0x0000000074CBE000-memory.dmp

    Filesize

    6.9MB

  • memory/1460-14-0x0000000000710000-0x0000000000720000-memory.dmp

    Filesize

    64KB

  • memory/1460-15-0x0000000005820000-0x0000000005B8C000-memory.dmp

    Filesize

    3.4MB

  • memory/1460-16-0x0000000000BC0000-0x0000000000BFE000-memory.dmp

    Filesize

    248KB

  • memory/1460-17-0x00000000745DE000-0x00000000745DF000-memory.dmp

    Filesize

    4KB

  • memory/1460-18-0x00000000745D0000-0x0000000074CBE000-memory.dmp

    Filesize

    6.9MB